github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2026-07-26 07:30:19 +00:00
Code Issues Projects Releases Wiki Activity

tests: run k8s-termination-log on the NVIDIA CPU runtime-rs handler

Browse Source 
The termination-log tests exercise termination-message propagation over
the agent GetDiagnosticData RPC, which only matters when the host cannot
read guest files directly, i.e. on shared_fs=none configurations. They
previously gated on is_confidential_runtime_class and therefore skipped
on the NVIDIA CPU runtime-rs handler, which now also runs with
shared_fs=none.

Add an is_shared_fs_none_runtime_class helper (confidential runtime
classes plus qemu-nvidia-cpu-runtime-rs) and use it for the setup and
teardown gating so the tests run on the NVIDIA CPU runtime-rs handler as
well. The plain Go qemu-nvidia-cpu class still uses virtio-fs and is
intentionally excluded. Keep the "blocked by default CoCo policy"
assertion confidential-only, since non-confidential shared_fs=none
classes do not ship a default policy that denies the RPC.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor with Claude Opus 4.8
This commit is contained in:
Fabiano Fidêncio
2026-07-18 12:31:29 +02:00
parent b6449fca2b
commit 271a797600
2 changed files with 31 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
tests/hypervisor_helpers.sh
View File

@@ -122,6 +122,21 @@ function is_confidential_runtime_class() {
fi
}
# Runtime classes that boot with shared_fs=none, where the host cannot read
# guest files directly. Data such as a container's termination log must then be
# retrieved over the agent GetDiagnosticData RPC instead of a shared filesystem.
# This covers the confidential runtime classes and the non-confidential NVIDIA
# CPU runtime-rs handler. The plain qemu-nvidia-cpu (Go) class still uses
# virtio-fs, so it is intentionally excluded.
function is_shared_fs_none_runtime_class() {
local hypervisor="${1:-${KATA_HYPERVISOR}}"
if is_confidential_runtime_class "${hypervisor}"; then
return 0
fi
[[ "${hypervisor}" == "qemu-nvidia-cpu-runtime-rs" ]] && return 0
return 1
}
# Runtime classes that boot a measured (dm-verity) rootfs: the confidential
# classes plus the CPU-only NVIDIA classes, which boot the verity-backed
# nvidia base image without being confidential.

22
tests/integration/kubernetes/k8s-termination-log.bats
View File

@@ -5,8 +5,9 @@
# SPDX-License-Identifier: Apache-2.0
#
# Test termination log propagation via GetDiagnosticData RPC.
# These tests target shared_fs=none configurations (e.g. qemu-coco-dev)
# where the host cannot directly read guest files.
# These tests target shared_fs=none configurations (e.g. qemu-coco-dev or the
# NVIDIA CPU runtime-rs handler) where the host cannot directly read guest
# files.
load "${BATS_TEST_DIRNAME}/lib.sh"
load "${BATS_TEST_DIRNAME}/../../common.bash"
@@ -14,9 +15,11 @@ load "${BATS_TEST_DIRNAME}/tests_common.sh"
load "${BATS_TEST_DIRNAME}/confidential_common.sh"
setup() {
# These tests only make sense on CoCo platforms (shared_fs=none).
if ! is_confidential_runtime_class; then
skip "Test requires a CoCo runtime class (shared_fs=none)"
# These tests only make sense on shared_fs=none configurations, where the
# host cannot read guest files directly and the termination log has to be
# fetched over the agent GetDiagnosticData RPC.
if ! is_shared_fs_none_runtime_class; then
skip "Test requires a shared_fs=none runtime class"
fi
setup_common || die "setup_common failed"
@@ -95,6 +98,13 @@ wait_for_pod_terminated() {
}
@test "Termination log: request blocked by default CoCo policy" {
# The default-deny behaviour is specific to the confidential runtime
# classes; non-confidential shared_fs=none classes (e.g. NVIDIA CPU
# runtime-rs) do not ship a default policy that blocks the RPC.
if ! is_confidential_runtime_class; then
skip "Default-deny policy check only applies to CoCo runtime classes"
fi
if ! auto_generate_policy_enabled; then
echo "# Skipping default CoCo policy check: requires AUTO_GENERATE_POLICY=yes" >&3
return 0
@@ -128,7 +138,7 @@ wait_for_pod_terminated() {
}
teardown() {
if ! is_confidential_runtime_class; then
if ! is_shared_fs_none_runtime_class; then
return
fi